Shai-hulud 2.0 Variant Threatens Cloud Ecosystem

Trend Micro researchers detail Shai-hulud 2.0, a wormable supply‑chain malware that compromises npm developer accounts via phishing, backdoors and repackages maintained packages, leverages GitHub access to propagate, harvests secrets using tools like TruffleHog, steals cloud credentials from AWS/GCP/Azure (including secrets manager and Azure Pod Identity), and includes destructive wiper functionality; the report includes IoCs and mitigation recommendations such as least-privilege tokens, CI/CD permission restrictions, dependency pinning, and visibility into package usage.